Possible Duplicate:
Why is h(m||k) insecure?

Length-extension allows to append any data to the message while not knowing the secret. Any length-extension explaination one the web considers the situation when the secret is prefixed to the data, but is this attack applicable to the situations when the secret is appended to the data?

  • 1
    $\begingroup$ No it isn't. But compared to, e.g., HMAC, it suffers from other flaws. See: Why is h(m||k) insecure? $\endgroup$ – Dennis Jan 4 '13 at 15:04
  • $\begingroup$ I closed the message as a duplicate of the message mentioned by Dennis. If you think your question is actually not a duplicate, please make edit it to make the difference clear and comment here, so we can reopen it. $\endgroup$ – Paŭlo Ebermann Jan 4 '13 at 19:18